- bootstrap.yml: install with --write-kubeconfig-mode=600, stop fetching the
admin kubeconfig to the controller, enforce root:root 0600.
- ansible/k3s-kubeconfig-mode.yml: narrow existing-host playbook with pinned
unit hashes, drift refusal, backup, config.yaml + flag rewrite, restart,
readiness/mode verification and rollback. Never prints unit/kubeconfig content.
- workplans/RCLUSTER-WP-0019: owner workplan; attended apply is T03 (human gate).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
The previous commit only included the staged portion (k3s tasks).
The working-tree additions (Helm install, kubeconfig fetch, version vars)
were never staged and were left behind.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Per ADR-002 (railiance-hosts/docs/adr/ADR-002-repo-boundary-hosts-vs-bootstrap.md):
- ansible/harden.yml: replaced with tombstone pointing to railiance-hosts
- ansible/bootstrap.yml: remove `import_playbook: harden.yml`; add
pre-condition comment; OS hardening is no longer this repo's concern
- docs/first_host.md: rewritten to reflect 3-step flow:
converge railiance-hosts → railiance-bootstrap k3s install → smoke test
- workplans/RAIL-BS-WP-0002-k3s-baseline.md: new workplan for k3s +
Helm + Kubernetes platform baseline; linked to repo goal 70ab2379
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Declares ansible>=10 as the only pip dependency for the control node.
Generates uv.lock pinning ansible 12.3.0 / ansible-core 2.19.7 and
the full transitive tree (13 packages). Adds explicit empty
ansible/requirements.yml confirming no Galaxy collections are used.
Closes RAIL-BS-WP-0001 T01–T04. Enables SBOM ingestion.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
